According to ISO 19011:2018, clause 6.6.2, a nonconformity is the non-fulfilment of a requirement. A nonconformity can be classified as either major or minor, depending on the nature and extent of the deviation from the audit criteria. A major nonconformity is a nonconformity that affects the ability or the integrity of the organization's management system to achieve the intended results. A minor nonconformity is a nonconformity that does not affect the ability or the integrity of the organization's management system to achieve the intended results, but is a deviation from the audit criteria1.
According to ISO/IEC 17021-1:2015, clause 9.4.9, the organization is required to analyze the cause and describe the specific correction and corrective actions taken, or planned to be taken, to eliminate detected nonconformities, within a defined time. The organization is also required to provide the certification body with records and evidence of the implementation and effectiveness of the correction and corrective actions taken.
The certification body will then verify the correction and corrective actions taken by the organization and decide on the certification status2.
Therefore, the two options of when the organization is required to act in response to reported findings are D and F, as they indicate the presence of nonconformities that need to be corrected and prevented from recurring.
The other options are not correct, as they do not require the organization to act in response to reported findings:
*A. A recommendation is given in the report: A recommendation is a suggestion for improvement that is not related to a nonconformity. A recommendation is not binding for the organization and does not affect the certification status. The organization may choose to accept or reject the recommendation, but it is not required to act on it.
*B. A finding of good practice is reported: A finding of good practice is a positive observation that indicates a strength or a best practice of the organization's management system. A finding of good practice is not related to a nonconformity and does not affect the certification status. The organization may choose to acknowledge or share the finding of good practice, but it is not required to act on it.
*C. An opportunity for improvement is raised: An opportunity for improvement is a potential area where the organization's management system can be enhanced or optimized. An opportunity for improvement is not related to a nonconformity and does not affect the certification status. The organization may choose to pursue or ignore the opportunity for improvement, but it is not required to act on it.
*E. A finding of conformity is reported: A finding of conformity is a confirmation that the organization's management system fulfils the audit criteria. A finding of conformity is not related to a nonconformity and does not affect the certification status. The organization may choose to celebrate or communicate the finding of conformity, but it is not required to act on it.
References: ISO 19011:2018(en), Guidelines for auditing management systems, ISO/IEC 17021-1:2015(en), Conformity assessment - Requirements for bodies providing audit and certification of management systems
- Part 1: Requirements

Explanation:
Identifying the source of information
Sampling available data
Gathering audit evidence
Verifying objective evidence
Evaluating evidence against the audit criteria
Making audit conclusions
Evaluating against the audit criteria
According to ISO 19011:2018, clause 6.4, the process of collecting and verifying information during an audit involves the following steps1:
Identifying the source of information: The audit team should identify the sources of information that are relevant to the audit objectives, scope and criteria. These sources may include documents, records, personnel, processes, activities, facilities, equipment, etc. The audit team should also determine the methods and tools for accessing and collecting the information, such as interviews, observations, document review, sampling, etc.
Sampling available data: The audit team should select a representative sample of the available data to verify the conformity and effectiveness of the management system. The sample size and selection method should be based on the audit objectives, scope and criteria, as well as the level of confidence and risk. The audit team should also consider the validity, reliability, relevance and sufficiency of the data.
Gathering audit evidence: The audit team should use the methods and tools identified in the previous step to collect audit evidence, which is the records, statements of fact or other information that are relevant to the audit criteria and verifiable. The audit team should record the audit evidence in a clear, concise and objective manner, using notes, checklists, photographs, audio or video recordings, etc.
Verifying objective evidence: The audit team should verify the accuracy, completeness and authenticity of the audit evidence collected. This may involve cross-checking different sources of information, confirming the identity and authority of the persons providing the information, examining the original documents or records, etc. The audit team should also identify any discrepancies, inconsistencies or gaps in the audit evidence.
Evaluating evidence against the audit criteria: The audit team should compare the audit evidence with the audit criteria to determine the extent of conformity and nonconformity. The audit team should also identify any opportunities for improvement, best practices, positive aspects or potential risks. The audit team should use professional judgement and apply the principles of auditing when evaluating the audit evidence.
Making audit conclusions: The audit team should consolidate the audit findings and evaluate the overall performance and effectiveness of the management system. The audit team should also consider the audit objectives, scope and criteria, as well as the context and expectations of the auditee and other interested parties. The audit team should provide a clear, concise and objective statement of the audit conclusions, which may include the degree of conformity, the achievement of the intended outcomes, the need for corrective actions, the suitability for certification, etc.
Evaluating against the audit criteria: The audit team should review the audit conclusions and ensure that they are consistent with the audit criteria and supported by sufficient and appropriate audit evidence.
The audit team should also ensure that the audit conclusions are communicated to the auditee and other relevant parties in a timely and effective manner, using the agreed audit report format and distribution method.
References: ISO 19011:2018(en), Guidelines for auditing management systems

Explanation:

Nonconformity report
ISO 9001 Clause Number: 9.3.1 Nature of problem: Management review has not been conducted at the defined frequency. ISO 9001 requirement that has not been fulfilled: ISO 9001 - "Top management shall review the organization's quality management system at planned intervals." Evidence: The last management review took place nine months ago, and the previous one took place one year before the latest review. The planned interval is six months.

According to the ISO 19011:2018 standard, which provides guidelines for auditing management systems, the team leader of an audit team should be an auditor who has demonstrated the competence to manage an audit of the relevant management system scheme. This means that the team leader should have the appropriate knowledge, skills, and experience to plan, conduct, report, and follow-up an audit of the specific management system, such as ISO 9001 for quality management systems. The other options are false because: B. An audit team can include non-qualified auditors, but only as observers or trainees who do not contribute to the audit findings or conclusions. C. A technical expert can assist a qualified auditor on an audit team, but cannot replace them, as a technical expert does not have the competence to perform audits. D. Audits leading to auditor qualification are not undertaken annually, but rather as part of a certification process that involves meeting certain criteria, such as education, work experience, audit experience, and examination. References:
ISO 19011:2018, PECB Certified ISO 9001 Lead Auditor Exam Preparation Guide, ISO 9001:2015 Quality Management Systems Lead Auditor Training Course

According to ISO 9001:2015, clause 9.2.2.e, the organization is required to retain documented information as evidence of the implementation of the audit programme and the audit results. This includes the records of the nonconformities identified during the internal audits and the corrective actions taken to address them. The organization is also required to verify the effectiveness of the corrective actions, as per clause 10.2.2.
Therefore, in the scenario given, the Quality Manager's decision to automatically close any nonconformance over 3 years old without obtaining any confirmation from the relevant departments or verifying the effectiveness of the corrective actions is a clear violation of the requirements of clause 9.2.2.e. This indicates a lack of control and follow-up of the internal audit process, as well as a potential risk of recurrence or occurrence of the nonconformities in other areas. This also undermines the credibility and value of the internal audit programme, as well as the risk-based approach claimed by the Quality Manager.
Hence, the best course of action to take is D, to raise a nonconformance report against clause 9.2.2.e of ISO
9001, and to communicate the audit findings to the relevant management. The other options are either insufficient or irrelevant to address the issue, as they do not directly relate to the noncompliance with clause
9.2.2.e.
References:
ISO 9001:2015(en), Quality management systems - Requirements, clause 9.2.2 and 10.2.2 ISO 19011:2018(en), Guidelines for auditing management systems, clause 6.4.4 and 6.7.2 ISO 9001 Lead Auditor Training Course | IRCA Certified | BSI, section "Learning objectives" ISO 9001 Lead Auditor Course Material | 3FOLD Education Centre, module 5 and 6